PT-2016-5193 · Unknown · Is-My-Json-Valid

Publicado 2016-02-23 · Atualizado 2018-07-31 · CVE-2016-2537

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions is-my-json-valid versions prior to 2.17.2 is-my-json-valid versions prior to 1.4.1

Description The issue is related to an incorrect regular expression in the is-my-json-valid package, which can cause a denial of service (blocked event loop) via a crafted string. This can be exploited by remote attackers. The vulnerability is also described as a regular expression denial of service (ReDoS) via the email validation function.

Recommendations Update to version 1.4.1 or later. Update to version 2.17.2 or later.

Correção

RCE

DoS

Enumeração de Fraquezas

CWE-20

CWE-1333

Identificadores relacionados

CVE-2016-2537

GHSA-CCQ6-3QX5-VMQX

GHSA-F522-FFG8-J8R6

Produtos afetados

Is-My-Json-Valid

Referências · 15

• https://github.com/github/advisory-database/pull/4850 · Nota
• https://github.com/mafintosh/is-my-json-valid · Nota
• https://github.com/mafintosh/is-my-json-valid/commit/eca4beb21e61877d76fdf6bea771f72f39544d9b · Correção
• https://github.com/mafintosh/is-my-json-valid/pull/159 · Nota
• https://github.com/mafintosh/is-my-json-valid/commit/b3051b277f7caa08cd2edc6f74f50aeda65d2976 · Nota
• https://osv.dev/vulnerability/GHSA-f522-ffg8-j8r6 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-2537 · Nota de Segurança
• https://hackerone.com/reports/317548 · Nota
• https://npmjs.com/advisories/572 · Nota
• https://osv.dev/vulnerability/GHSA-ccq6-3qx5-vmqx · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-2537 · Aviso do Fabricante
• https://npmjs.com/advisories/76 · Nota
• https://github.com/advisories/GHSA-f522-ffg8-j8r6 · Nota
• https://nodesecurity.io/advisories/76 · Nota
• https://github.com/advisories/GHSA-ccq6-3qx5-vmqx · Nota